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(54) Reciprocal transfer system 

(57) A reciprocal transfer system for transfer involving a user and supplier (e.g. retailer) comprises a biometric feature 
analyser (4) which obtains at least one feature from the user and verifies it to provide a resulting parameter. This parameter 
is combined with other parameters which may be unrelated to the identification of the user to produce a final risk 
assessment parameter. Control means (3) indicate to the supplier whether or not the transaction should proceed in 
accordance with the final risk assessment parameter. 
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At least one drawing originally filed was informal and the print reproduced here is taken from a later filed formal copy. 
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RECIPROCAL TRANSFER SYSTEM 
The invention relates to a transfer of value 
application in which a user wishes to receive services or 
5 goods from a supplier in return for a reciprocal transfer 
of funds or commitment to recognise the value of the 
service supplied. 

In a typical multilateral decision making situation, 
each party has a different set of interests and 
10 priorities and frequently there has to be a compromise 
between conflicting decision criteria. For example, in 
the case of a typical payment situation involving a 
customer (bank account holder) , a retailer and a bank, 
the customer desires no fraudulent use of the account, 
15 the retailer wants guaranteed payment without turning 
down any customers, and the bank wants no repudiations 
(particularly successful ones) with processed 
transactions. 

When cash is involved in the transfer of value, the 

20 supplier has a guarantee that the funds or commitment 
supplied by the user will be recognised by the issuer of 
the cash. However, more recently it has become common 
for users to tender a credit or debit card which does not 
in itself guarantee that funds or commitment will be 

25 guaranteed by the issuer of the card who provides a main 
element of the Reciprocal Transfer Service. 

The invention is concerned with such multilateral 
exchanges in which there are at least three parties, that 
is the user, the supplier, and the reciprocal transfer 

30 service which will often be a bank. 

In the past, the reciprocal transfer service has had 
to rely on the decision ability of the supplier to 
confirm that the user is positively identified and that 
the supplier is granted authority to access the users 

35 account. Generally this has involved requesting the user 
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to provide his signature which is then visually compared 
with a reference signature on a card. In some 
situations, the supplier has been provided with aids to 
assist with this comparison such as a signature pad. 

5 There is a need for the reciprocal transfer service 

to have more control over transfers of value and to 
reduce the reliance on the supplier. 

In accordance with one aspect of the present 
invention, a reciprocal transfer system for use in a 
10 transfer of value involving a user who is to receive 
goods or services from a supplier in return for funds or 
a commitment to recognise the value of the received 
goods or services, the system comprising a biometric 
feature analyser for obtaining from the user at least one 

15 biometric feature and for performing a verification 
analysis on the feature to generate at least one 
parameter representing the result of the analysis; and 
control means coupled to the biometric feature analyser 
for combining in accordance with a predetermined 

20 algorithm the verification analysis parameter or 
parameters with one or more parameters relating to the 
transfer of value operation and unrelated to the 
identification of the user, to generate a final risk 
assessment parameter, the control means being adapted 

25 thereafter to indicate to the supplier in accordance with 
the final risk assessment parameter whether or not the 
transaction of value can proceed. 

In accordance with a second aspect of the present 
invention, a method of determining whether to perform a 

30 transfer of value involving a user who is to receive 
goods or services from a supplier in return for funds or 
a commitment to recognise the value of the received goods 
or services, the user and the supplier conducting the 
transfer of value in conjunction with a reciprocal 

35 transfer system comprises obtaining from the user at 
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least one biometric feature; performing a verification 
analysis on the feature and generating at least one 
parameter representing the result of the analysis; and 
combining in accordance with a predetermined algorithm 
5 the verification analysis parameter or parameters with 
one or more parameters relating to the transfer of value 
operation and unrelated to the identification of the 
user, to generate a final risk assessment parameter, the 
reciprocal transfer system thereafter indicating to the 
10 supplier in accordance with the final risk assessment 
parameter whether or not the transaction of value can 
proceed. 

We have recognised the inherent problems with 
biometric methods of user verification which cannot in 

15 general give 100% confidence in the verification of 
identity. Consequently, we now propose combining the 
results of the biometric verification analysis with 
other, typically application specific, parameters 
independent of the biometric features so as to reduce the 

20 effect of the uncertainty of the biometric analysis 
itself. 

In one example, the control means has a store for 
storing at least the recent history of previous uses of 
the system by each user, that history being used by the 

25 control means to constitute one of the additional 
parameters. Typically, the significance attached to the 
history will reduce with time and in practice the store 
may comprise a circular buffer arranged to contain a 
limited, fixed number of transaction details. 

30 Alternatively, or in addition to the above, the 

control means may include a store for storing parameters 
relating to the user which are selected singly or in 
combination by the control means to constitute one of the 
additional parameters. These stored parameters relating 

35 to the user may include physical characteristics such as 
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age, sex, social group, psychological profile, 
handedness, and application related parameters. 

In addition or alternatively to the above, the 
additional parameters may be chosen from the following; 
5 a) Supplier profile parameters eg type of service 

(for example retailer classification) , typical levels of 
service (for example average transaction values) and risk 
level of location; 

b) Probability of fraud; 
10 c) Value of service; 

d) Time and date of transaction; 

e) Environmental conditions. 

The predetermined algorithm preferably has the form; 
R = W 2 F 1 (P 1# P 2 ... P N ) + W 2 F 2 (P x , P 2 ... P N ) + ... 

15 

where R is the final risk assessment parameter, 

W l W 2 etc are res P ect ^ ve weights, 

P^ P 2 etc are the parameter values, and 

F l' F 2 etc are funct i° ns generating a score or 
20 absolute value for a given parameter set. 

In one application, the control means compares the 
final risk assessment parameter (R) with at least one 
threshold to determine whether the transaction of value 
can proceed. 

25 In the preferred arrangement, the thresholds define 

3 bands so that if the final risk assessment parameter 
falls in one band the control means indicates that the 
transaction of value can proceed, if it falls in another 
band the control means indicates that the transfer of 

30 value cannot proceed, and if it falls in an intermediate 
band the control means performs a further algorithm. 

This further algorithm may be similar to the 
algorithm defined above but makes use of different 
weighting factors so that the parameters are combined in 

35 a different manner. 
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Typically the control means will be sited together 
with the biometric frature analyser at the point at which 
the transaction occurs (i.e. point of sale) and off-line 
to the reciprocal transfer service provider. The control 
5 means may also be sited remote from the biometric feature 
analyser at some central location and on line to the 
reciprocal transfer service provider. Furthermore there 
may be a number of biometric analysers connected to a 
common control means. 

10 This arrangement is particularly suitable for use in 

an electronic funds transfer at point of sale (EFTPOS) 
system since the reciprocal transfer system can 
automatically indicate to the EFTPOS system that a 
transaction of value can proceed allowing that transfer 

15 of value to proceed automatically with a minimum of 
operator intervention , 

The parameter or parameters generated by the 
biometric feature analyser can indicate the degree to 
which a submitted biometric feature is simular to a 

20 reference feature and preferably these parameters 
correspond to those described in our co-pending British 
patent application^ filed on the 3rd November 1989 and 
entitled "Improvements relating to individual 
verification" (Agents Ref : 30/3035/01) . 

25 An example of an EFTPOS system incorporating a 

reciprocal transfer system and method according to the 
invention will now be described with reference to the 
accompanying drawings, in which :- 

Figure 1 is a block diagram of an off-line system; 

30 and, 

Figure 2 is a block diagram of an on-line system. 
In both the reciprocal transfer applications 
described, a number of parties are involved including at 
least the following: The consumer's bank, the retailer's 
35 bank and the EFTPOS acquirer who gives the service 



6 



transfer guarantee to the retailer that the transfer of 
value may proceed. The EFTPOS acquirer provides 
apparatus to the retailer to initiate the reciprocal 
transfer and to assist in the verification of the 

5 consumer or user. The consumer's bank issues an 
identification token such as a card to the consumer to 
provide a machine readable method of identifying the 
consumer's account. 

In the apparatus shown in Figure 1, a card reader 1 
10 is provided such as a Swipe reader which reads from a 
consumer's card details of his bank account and the like 
together with reference biometric data. The account 
details are fed from the reader to a conventional EFTPOS 
terminal 2 while the reference biometric data is fed to a 

15 microprocessor 3. In this example, the microprocessor 3 
is provided locally to the EFTPOS terminal 2. A 
biometric feature analyser 4 is connected to the 
microprocessor 3 and is adapted to obtain from the 
consumer current biometric features. In another example 

20 the microprocessor 3 may be a combined element of EFTPOS 
terminal 2 i.e. one microprocessor may service both the 
biometric and EFTPOS functions. 

In one example, the consumer presents his card to 
the retailer who places the card in the card reader 1 to 

25 allow the reference biometric data and the bank account 
data to be down loaded to the microprocessor 3 and EFTPOS 
terminal 2 respectively. The consumer then supplies the 
necessary biometric data in the form of a submission to 
the analyser 4. For example, this can comprise writing 

30 his signature on a signature pad forming part of the 
analyser 4 f the analyser then obtaining from that 
signature, data relating to both static and dynamic 
characteristics of the signature. These features are 
then supplied to the microprocessor 3 which performs a 

35 signature analysis on the submitted data and the 
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reference data. This analysis would typically be of the 
form described in more detail in the co-pending British 
application mentioned above the content of which is 
included herein by reference. The result of that 
5 biometric or signature analysis is the generation of a 
number of parameters including a confidence of match, a 
variance, a vulnerability, and a composite biometric 
level of confidence. The confidence of match parameter 
is derived from the comparison of the biometric 

10 submission with the reference; the variance parameter is 
derived from an assessment of the level of variance 
exhibited by the service user or consumer over a period 
of time and provides an indication of whether the 
confidence of match parameter is within an acceptable 

15 range; and the vulnerability parameter is an assessment 
of the degree of difficulty in f orging/counterf ietting 
the biometric property of the user or consumer. The 
composite biometric level of confidence is derived from a 
function which combines the 3 parameters mentioned above 

20 together with the possibility of a fraudulent service 
user. This composite biometric level of confidence 
parameter is denoted 

A second parameter PR 2 provides a composite service 
provider/type of service risk assessment and is generated 

25 from one or a combination of the following parameters: 

i) . Service provider profile. This identifies the 
service provider and defines characteristics such as type 
of service (e.g. retailer classification), typical levels 
of service (e.g. average transaction value) and risk 

30 level of location. 

The concept of floor limits in point of sale 
payments is a mechanism used to quantify the risk level 
of the location, and is not a primary parameter type. 

ii) . Probability of fraud. This value may vary over 
35 time or between service providers. This is an input to 
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the biometric verification sub-system to allow the 
composite biometric verification sub- system to allow the 
composite biometric level of confidence to be generated. 

iii) ♦ Value of Service. This is the value that is 
5 processed by the reciprocal transfer system, e.g. 

transaction amount. 

iv) . Time and date. The time of day, day of week, 
and special seasons of the year may all be significant. 

v) . Environmental issues. These cover factors such 
10 as climatic conditions. 

A third parameter PR3 defining a composite user 
risk assessment is produced for one or a combination of 
the following parameters: 

i) . Usage pattern. This is a record of previous use 
15 and assumes that significance reduces the further one 

goes back in time. In practice, this is likely to be a 
circular buffer limited to a fixed number of 
transactions . 

ii) . User profile. This covers any other parameters 
20 which are significant to the application such as physical 

characteristics (e.g. age, sex, social group, 
psychological profile, handed-ness) and application 
related parameters. 

Each of these parameters PR^ PR 2 , PR^ is a function 
25 of one or more of the base parameters referred to and for 
example PR 2 can be defined as: 

SCORE « [ W- * P (service provider profile) + 
1 spp 

W 2 F vts (value and type of service) + 

30 W. * F^., (time and date) + 

3 ta 

W. * F . (environmental issues) ] 

4 ei 

W- . are signed weighting values, 
x . . *» 

F is a function which generates a 
ssp 

numeric value by classifying the 
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details comprising the service 
provider profile. 
F vts is a function which generates a 
numeric value by classifying the 
5 value of the transaction, and 

possibly also the type of 
transaction. 

is a function which generates a 
numeric value by classifying time, 
10 date and possible special periods 

(e.g. pre-Christmas) into risk 
levels. 

F . Is a function which tests for 
ei 

special circumstances surrounding 
15 environmental issues such as 

extremes of temperature. 

Similarly, Function PR^ can be defined as: 

20 SCORE = [ W- * F (user profile) + 

5 sup r 

W 6 * F up * usa 9 e pattern, transaction 
value and type, time and 
date) ] 

where: 

25 w c - are signed weighting values. 

F is a function which generates a 
sup 

numeric value by classifying the 
details comprising the user profile, 

F up * s a f unct * on which generates a 
30 numeric value by analysing the 

previous pattern of usage and 
comparing it to the circumstance 
surrounding the current one. 
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The output scores for the three composite parameters 
are then classified into respective classes or bands to 
define three such classes, giving the values 

X in the range 1 . . . x+1 from PRj^ 
Y in the range 1 ... y+1 from PR 2 

Z in the range 1 ... z+l from PR 3 

The microprocessor 3 includes a three dimensional 
look-up table whose elements are addressed by the band or 
class values, the three bands derived above being used 
therefore to address the look-up tables to obtain a risk 
assessment parameter. Each element of the array contains 
one of the following set of values: 

-1 Pass - proceed with transfer* of value 

0 Fail - do not proceed with transfer of value 

1 Resort to SA^^ for decision 

2 Resort to SA 2 for decision 
• • • * • » 

n Resort to SA^ for decision 
n 

Each SA {Secondary Algorithm) is a function which 
has as input all the individual parameters listed above 
plus the composite functions PR^ - PR^ . For each SA^, a 
different set of weights exists, one for each input 
parameter. Like the above functions, each value is 
multiplied by the weighting and all products added 
together to produce a score. 

The score of each SA fl is divided into three bands by 
two thresholds, which are again unique to each SA. Band 
1 means fail, band 2 means resort to other procedures, 
and band 3 means pass. 

Clearly, different SA's will attach different 
priorities to different categories of risk. For example, 
where the value is modest but the biometric risk is high, 
more detailed attention will be paid to the biometric 
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parameters. Similarly, a high value transaction may 
attach more significance to the usage pattern. 

In the Figure 1 example, the card supplied by the 
consumer contains the biometric reference data as well as 
5 the bank account data to enable local operations. 

Figure 2 illustrates a different arrangement in 
which the computer which decides and determines the final 
risk assessment parameter is located remotely from the 
EFTPOS terminal 2. In this example, the consumer's card 

10 identifies the bank account and the location of the 
consumer's reference data in a store 5 remote from the 
terminal 2, typically at the banks premises. Biometric 
features are obtained from the consumer by the analyser 4 
and sent via the EFTPOS terminal 2 along a link 6 to the 

15 consumers bank 7. Typically, the link 6 forms part of a 
conventional EFTPOS system. A computer 8 located at the 
consumer's bank then extracts the reference biometric 
data from the store 5 and performs the biometric analysis 
together with the further risk analysis to generate the 

20 final risk assessment parameter in the same way as 
described above in connection with Figure 1, this final 
risk assessment parameter then being supplied back to the 
terminal along a link 9 to control whether the 
transaction of value proceeds or not. 

25 
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CLAIMS 

1. A reciprocal transfer system for use in a transfer of 
value involving a user who is to receive goods or 
services from a supplier in return for funds or a 
commitment to recognise the value of the received goods 
or services, the system comprising a biometric feature 
analyser (4) for obtaining from the user at least one 
biometric feature and for performing a verification 
analysis on the feature to generate at least one 
parameter representing the result of the analysis; and 
control means (3) connected to the biometric feature 
analyser for combining in accordance with a predetermined 
algorithm the verification analysis parameter or 
parameters with one or more parameters relating to the 
transfer of value operation and unrelated to the 
identification of the user, to generate a final risk 
assessment parameter, the control means thereafter 
indicating to the supplier in accordance with the final 
risk assessment parameter whether or not the transaction 
of value can proceed. 

2. A system according to claim 1, wherein the control 
means include a store for storing a history of previous 
use by the user, the history being used by the control 
means as one of the additional parameters. 

3. A system according to claim 1 or claim 2, wherein the 
control means stores parameters relating to the profile 
of each user for use alone or in combination as an 
additional parameter. 

4. A system according to any of the preceeding claims, 
wherein one or more of the additional parameters is 
selected from: 

a) Supplier profile parameters; 

b) Probability of fraud; 

c) Value of service; 

d) Time and date of transaction; 
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e) Environmental conditions. 
5. A system according to any of the preceeding claims, 
wherein the predetermined algorithm has the form: 

R = W 1 F 1 (P lf P 2 ... P N ) + W 2 F 2 [? v P 2 . P N ) + 



where R is the final risk assessment parameter, 
W 1 W 2 etc are respective weights, 

P l P 2 etC are t * ie P arameter va l u€s f an< * 
10 P 1# F 2 etc are functions generating a score or 

absolute value for a given parameter set. 

6. A system according to any of the preceeding claims, 
wherein the control means includes comparison means to 
compare the final risk assessment parameter with at least 

15 one threshold. 

7. A system according to claim 6, wherein the thresholds 
define 3 bands so that if the final risk assessment 
parameter falls in one band the control means indicates 
that the transfer of value can proceed, if it falls in 

20 another band the control means indicates that the 
transfer of value cannot proceed, and if it falls in an 
intemediate band the control means performs a further 
algorithm. 

8. A system according to claim 7, wherein if the final 
25 risk assessment parameter lies in the intermediate band 

then the control means determines a further final risk 
assessment parameter (R 1 ) in accordance with the formula: 
R' = W x ' T 1 (P 1# P 2 ... P N > + W 2 ' F 2 (P 1 , P 2 ... P N > + 
where W^, W 2 ' etc are respective weights, 
30 P^, P 2 etc are the parameter values, and 

F , F 2 etc are functions generating a score 
or absolute value for a given parameter set. 

9. A transfer of value system comprising transaction 
apparatus for debiting funds from a user and crediting 

35 those funds to a supplier; and a reciprocal transfer 
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system according to any of the preceeding claims, for 
indicating to the apparatus whether or not the transfer 
can proceed. 

10. A method of determining whether to perform a transfer 
of value involving a user who is to receive goods or 
5 services from a supplier in return for funds or a 
commitment to recognise the value of the received goods 
or services, the user and the supplier conducting the 
transfer of value in conjunction with a reciprocal 
transfer system, the method comprising obtaining from the 

10 user at least one bioraetric feature; performing a 
verification analysis on the feature to generate at least 
one parameter representing the result of the analysis; 
and combining in accordance with a predetermined 
algorithm the verification analysis parameter or 

15 parameters with one or more parameters relating to the 
transfer of value operation and unrelated to the 
identification of the user to generate a final risk 
assessment parameter, the reciprocal transfer system 
thereafter indicating to the supplier in accordance with 

20 the final risk assessment parameter whether or not the 
transaction of value can proceed. 
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